Zombie Licenses: Payroll for People Who Don't Work Here.

Every company has an offboarding checklist, and almost every one of them contains the same hole. Collect the laptop. Disable the account. Forward the mail to a manager. Somewhere in there, on nearly every checklist I've ever seen, one line is missing: reclaim the license.

When someone leaves, this is what actually happens. IT disables the account, which is the security-critical step, and everyone moves on. But a disabled account isn't an unlicensed account. The seat stays assigned. The subscription keeps billing. Microsoft does not send a courtesy note asking whether Jessica still works there. And because the invoice arrives at roughly the same size it was last month, nothing anywhere flags that the company is now paying a software seat for a person who cleaned out her desk in March.

That's a zombie license. Dead account, live billing. And the defining feature of zombies is the reason they survive: they don't complain. A broken laptop generates a ticket. An unhappy user generates a phone call. A license assigned to nobody generates nothing at all, forever, which in most companies means it outlives the memory of the person it belonged to.

They multiply through more doors than offboarding, too. Migrations leave duplicate accounts behind, both licensed. A project spins up eight seats for contractors and the project ends but the seats don't. A service account gets created with a full premium license because that's what the wizard defaulted to, and a mailbox that exists only to send automated reports has been carrying an E5 seat since 2022. None of these are anyone's failure exactly. They're what happens when assignment is an event and review is nobody's job.

The zombie license finder in SCOUTz does the review nobody's doing, and the logic is almost embarrassingly simple. Cross-reference three things the tenant already knows: which seats carry licenses, which accounts are active versus disabled, and when a human last actually signed in. Then ask one question per seat: is a living person using this? Licensed and disabled, that's a zombie. Licensed, enabled, and untouched since last autumn, that's a zombie with better paperwork. The tenant has held all three answers all along. Nobody had ever put them in the same room.

Now the part that makes this my favorite kind of finding to hand an MSP: the math is monthly. Find a security gap and you've prevented a hypothetical. Find eleven zombie seats and you've recovered a specific dollar figure that was recurring, every month, backward as far as anyone wants to calculate and forward forever. Present it that way. Not "you have unused licenses" but "here's what these seats cost since the people left, and here's the number that stops appearing on next month's bill." Owners can't feel a threat matrix. They can absolutely feel eighteen months of payroll for people who don't work there.

And the remediation might be the easiest project approval in all of IT. There's no risk conversation, no downtime, no change management anxiety. Remove licenses from the dead, downgrade the over-provisioned, and set up the thing that actually fixes it long-term: a license reclamation step in offboarding and a quarterly zombie sweep so the graveyard never refills. That last part is the real service, by the way. Anyone can clear zombies once. The MSP who guarantees they stay cleared has attached themselves to the client's spend in the most defensible way possible: as the reason it keeps going down.

Walk the graveyard. Every tenant has one. The seats can't speak up, so somebody with a scan has to. # Cluster 4: The Trust Position